Web Request
Introduction
The Web Request tool makes HTTP calls to public APIs and websites. It returns the status, headers, and body, and blocks any request that would resolve to a private network.
Making Requests
| Parameter | Required | Description |
|---|---|---|
operation | Yes | One of get, head, post, put, patch, delete |
url | Yes | The URL to request |
headers | No | Object of header name/value pairs |
body | No | Request body for post, put, patch. JSON is detected automatically. |
The response is returned as JSON containing status, a filtered subset of headers (content-type, content-length, location, x-request-id), and the response body.
Allowed Methods
All six standard HTTP methods are supported. Anything else returns an error.
Response Limits
Responses are truncated at 100 KB. The request has a hard timeout of 15 seconds and follows up to 5 redirects. Each redirect URL is re-validated against the private network filter before being followed.
Private Network Protection
The tool will refuse to connect to any host that resolves to a private, loopback, or link-local address. This includes:
127.0.0.0/8(loopback)10.0.0.0/8,172.16.0.0/12,192.168.0.0/16(RFC 1918)169.254.0.0/16(link-local)::1,fc00::/7,fe80::/10(IPv6 equivalents)
Every DNS A and AAAA record for the host is checked, so a hostname can't hide a private IP behind a public answer (DNS rebinding defense).
!NOTE The tool description hints at fetching
https://markdown.new/{url}to get a webpage as clean Markdown instead of raw HTML, so the agent picks it up automatically when reading pages.